The alleged A$30 million Romanian credit card scam caused possibly the largest remediation effort ever undertaken within the Australian consumer payments system in the 18 months before last week’s arrest of the scammers.
Only 46 stores were confirmed to have been hacked in the scam last week, at a cost estimated at $30 million.
But industry sources have told Banking Day that thousands of merchants were required to have their systems “remediated” in the months after the scam came to light in June 2011, to fix their vulnerability. The remediations needed included changes to software, hardware and network configurations needed to prevent access to customer data.
Many of the stores affected were franchisees of Metcash’s IGA grocery chain, sources confirmed. A spate of mid-2011 media reports described unsolved fraud outbreaks centred on IGA stores from as far afield as the Melbourne suburb of Warrandyte to regional Victorian towns like Horsham and Castlemaine and NSW regional towns such as Orange and Junee.
The victims of the Warrandyte fraud wave, which was centred on the Warrandyte SUPA IGA store, reportedly included two police officers.
At publication time, it remains unclear whether sanctions will be applied to anyone in the chain of parties that allowed the system vulnerabilities to be created and to continue for several years.
The scam was enabled by poor store decisions about hardware, software and IT service providers that may have been influenced both by franchisors such as IGA and by the acquiring banks. A Mastercard spokesperson told Banking Day that the acquiring banks were responsible for ensuring that their merchants complied with the industry data security standard, PCI DSS.